A vulnerability was determined in diem-project diem up to 5.1.3. (CVE-2026-86182)

The vulnerability identified as CVE-2026-86182 affects diem-project diem versions up to 5.1.3. It resides in the executeCommand function within the dmAdminPlugin/modules/dmConsole/actions/actions.class.php file of the dmConsole component. The flaw is a cross-site request forgery (CWE-352) caused by improper validation of the dm_command argument, enabling remote attackers to induce unintended commands via crafted requests. The issue was reported early to the project but remains unaddressed. The CVSS 3.1 base score is 4.3 (low), reflecting network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. Exploit code has been publicly disclosed, but no known exploitation in the wild has been confirmed.

An attacker can remotely induce a victim to execute unintended commands on the affected diem-project diem system by exploiting the CSRF vulnerability. This may lead to limited integrity impact due to unauthorized command execution. There is no confidentiality or availability impact reported. The vulnerability requires user interaction and does not require privileges, making it accessible but with limited impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or released a fix, users should monitor official channels for updates. In the meantime, mitigating CSRF risks by implementing standard protections such as CSRF tokens and validating user requests in the affected component may reduce exposure.